summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/stls/stls_server_init_and_handshake.c48
-rw-r--r--src/tls/s6-tlsd-io.c14
-rw-r--r--src/tls/s6-tlsd.c14
-rw-r--r--src/tls/s6-tlsserver.c11
-rw-r--r--src/tls/s6-ucspitlsd.c16
-rw-r--r--src/tls/s6tls-internal.h2
-rw-r--r--src/tls/s6tls_exec_tlsdio.c11
7 files changed, 84 insertions, 32 deletions
diff --git a/src/stls/stls_server_init_and_handshake.c b/src/stls/stls_server_init_and_handshake.c
index 4a5b2ff..2cc9585 100644
--- a/src/stls/stls_server_init_and_handshake.c
+++ b/src/stls/stls_server_init_and_handshake.c
@@ -4,6 +4,8 @@
#include <tls.h>
+#include <skalibs/posixplz.h>
+#include <skalibs/bytestr.h>
#include <skalibs/strerr2.h>
#include <s6-networking/stls.h>
@@ -23,15 +25,40 @@ struct tls *stls_server_init_and_handshake (int const *fds, tain_t const *tto, u
cfg = tls_config_new() ;
if (!cfg) strerr_diefu1sys(111, "tls_config_new") ;
- x = getenv("CERTFILE") ;
- if (!x) strerr_dienotset(100, "CERTFILE") ;
- if (tls_config_set_cert_file(cfg, x) < 0)
- diecfg(cfg, "tls_config_set_cert_file") ;
-
- x = getenv("KEYFILE") ;
- if (!x) strerr_dienotset(100, "KEYFILE") ;
- if (tls_config_set_key_file(cfg, x) < 0)
- diecfg(cfg, "tls_config_set_key_file") ;
+ if (!(preoptions & 8)) /* snilevel < 2 */
+ {
+ char const *y = getenv("CERTFILE") ;
+ if (!y) strerr_dienotset(100, "CERTFILE") ;
+ x = getenv("KEYFILE") ;
+ if (!x) strerr_dienotset(100, "KEYFILE") ;
+ if (tls_config_set_keypair_file(cfg, y, x) < 0)
+ diecfg(cfg, "tls_config_set_keypair_file") ;
+ }
+ if (preoptions & 4) /* snilevel > 0 */
+ {
+ char const *const *envp = (char const *const *)environ ;
+ for (; *envp ; envp++)
+ {
+ if (str_start(*envp, "KEYFILE:"))
+ {
+ size_t len = strlen(*envp) ;
+ size_t kequal = byte_chr(*envp, len, '=') ;
+ if (kequal == len) strerr_dief1x(100, "invalid environment") ;
+ if (kequal != 8)
+ {
+ char certvar[len - kequal + 10] ;
+ memcpy(certvar, "CERTFILE:", 9 ;
+ memcpy(certvar + 9, *envp + 8, kequal - 8) ;
+ certvar[kequal + 1] = 0 ;
+ x = getenv(certvar) ;
+ if (!x)
+ strerr_dief3x("environment variable KEYFILE:", certvar + 9, " not paired with the corresponding CERTFILE") ;
+ else if (tls_config_add_keypair_file(cfg, x, *envp + kequal + 1) < 0)
+ diecfg(cfg, "tls_config_add_keypair_file") ;
+ }
+ }
+ }
+ }
stls_drop() ;
@@ -76,7 +103,8 @@ struct tls *stls_server_init_and_handshake (int const *fds, tain_t const *tto, u
tls_config_free(cfg) ;
if (tls_accept_fds(sctx, &ctx, fds[0], fds[1]) < 0)
diectx(97, sctx, "tls_accept_fds") ;
- tls_free(sctx) ;
+ /* We can't free sctx, ctx has pointers into it! Stupid API. We let sctx leak. */
+ /* tls_free(sctx) ; */
stls_handshake(ctx, tto) ;
return ctx ;
}
diff --git a/src/tls/s6-tlsd-io.c b/src/tls/s6-tlsd-io.c
index 060537a..f4a58ce 100644
--- a/src/tls/s6-tlsd-io.c
+++ b/src/tls/s6-tlsd-io.c
@@ -13,7 +13,7 @@
#include <s6-networking/config.h>
-#define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] fdr fdw"
+#define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k snilevel ] fdr fdw"
#define dieusage() strerr_dieusage(100, USAGE)
static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned int, unsigned int) gccattr_noreturn ;
@@ -66,7 +66,7 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3
#endif
#endif
-int main (int argc, char const *const *argv, char const *const *envp)
+int main (int argc, char const *const *argv)
{
tain_t tto ;
int fds[4] = { 0, 1, 0, 1 } ;
@@ -81,7 +81,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
unsigned int t = 0 ;
for (;;)
{
- int opt = subgetopt_r(argc, argv, "d:SsYyv:K:", &l) ;
+ int opt = subgetopt_r(argc, argv, "d:SsYyv:K:k:", &l) ;
if (opt == -1) break ;
switch (opt)
{
@@ -92,6 +92,14 @@ int main (int argc, char const *const *argv, char const *const *envp)
case 'Y' : preoptions |= 1 ; preoptions &= ~2 ; break ;
case 'y' : preoptions |= 3 ; break ;
case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+ case 'k' :
+ {
+ unsigned int snilevel ;
+ if (!uint0_scan(l.arg, &snilevel)) dieusage() ;
+ if (snilevel) preoptions |= 4 ;
+ if (snilevel >= 2) preoptions |= 8 ;
+ break ;
+ }
default : dieusage() ;
}
}
diff --git a/src/tls/s6-tlsd.c b/src/tls/s6-tlsd.c
index 361502e..9432bd7 100644
--- a/src/tls/s6-tlsd.c
+++ b/src/tls/s6-tlsd.c
@@ -12,24 +12,25 @@
#include "s6tls-internal.h"
-#define USAGE "s6-tlsd [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
+#define USAGE "s6-tlsd [ -S | -s ] [ -Y | -y ] [ -k snilevel ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
#define dieusage() strerr_dieusage(100, USAGE)
-static void child (int const [4][2], uint32_t, unsigned int, unsigned int) gccattr_noreturn ;
-static void child (int const p[4][2], uint32_t options, unsigned int verbosity, unsigned int kimeout)
+static void child (int const [4][2], uint32_t, unsigned int, unsigned int, unsigned int) gccattr_noreturn ;
+static void child (int const p[4][2], uint32_t options, unsigned int verbosity, unsigned int kimeout, unsigned int snilevel)
{
int fds[3] = { p[0][0], p[1][1], p[2][1] } ;
PROG = "s6-tlsd (child)" ;
close(p[2][0]) ;
close(p[0][1]) ;
close(p[1][0]) ;
- s6tls_exec_tlsdio(fds, options, verbosity, kimeout) ;
+ s6tls_exec_tlsdio(fds, options, verbosity, kimeout, snilevel) ;
}
int main (int argc, char const *const *argv)
{
unsigned int verbosity = 1 ;
unsigned int kimeout = 0 ;
+ unsigned int snilevel = 0 ;
int p[4][2] = { [3] = { 0, 1 } } ;
uint32_t coptions = 0 ;
uint32_t poptions = 1 ;
@@ -40,7 +41,7 @@ int main (int argc, char const *const *argv)
subgetopt_t l = SUBGETOPT_ZERO ;
for (;;)
{
- int opt = subgetopt_r(argc, argv, "SsYyv:K:Zz", &l) ;
+ int opt = subgetopt_r(argc, argv, "SsYyv:K:Zzk:", &l) ;
if (opt == -1) break ;
switch (opt)
{
@@ -52,6 +53,7 @@ int main (int argc, char const *const *argv)
case 'K' : if (!uint0_scan(l.arg, &kimeout)) dieusage() ; break ;
case 'Z' : poptions &= ~1 ; break ;
case 'z' : poptions |= 1 ; break ;
+ case 'k' : if (!uint0_scan(l.arg, &snilevel)) dieusage() ; break ;
default : dieusage() ;
}
}
@@ -65,7 +67,7 @@ int main (int argc, char const *const *argv)
switch (pid)
{
case -1 : strerr_diefu1sys(111, "fork") ;
- case 0 : child(p, coptions, verbosity, kimeout) ;
+ case 0 : child(p, coptions, verbosity, kimeout, snilevel) ;
default : break ;
}
s6tls_sync_and_exec_app(argv, p, pid, poptions) ;
diff --git a/src/tls/s6-tlsserver.c b/src/tls/s6-tlsserver.c
index 0a6ae78..623bbfa 100644
--- a/src/tls/s6-tlsserver.c
+++ b/src/tls/s6-tlsserver.c
@@ -15,7 +15,7 @@
#define USAGE "s6-tlsserver [ -e ] [ options ] ip port prog...\n" \
"s6-tcpserver options: [ -q | -Q | -v ] [ -4 | -6 ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ]\n" \
"s6-tcpserver-access options: [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ]\n" \
-"s6-tlsd options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ]"
+"s6-tlsd options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ] [ -k snilevel ]"
#define dieusage() strerr_dieusage(100, USAGE)
@@ -34,6 +34,7 @@ struct options_s
unsigned int backlog ;
unsigned int timeout ;
unsigned int kimeout ;
+ unsigned int snilevel ;
unsigned int verbosity : 2 ;
unsigned int flag46 : 2 ;
unsigned int flag1 : 1 ;
@@ -66,6 +67,7 @@ struct options_s
.timeout = 0, \
.kimeout = 0, \
.verbosity = 1, \
+ .snilevel = 0, \
.flag46 = 0, \
.flag1 = 0, \
.flagU = 0, \
@@ -91,7 +93,7 @@ int main (int argc, char const *const *argv)
subgetopt_t l = SUBGETOPT_ZERO ;
for (;;)
{
- int opt = subgetopt_r(argc, argv, "qQv461c:C:b:G:g:u:UWwDdHhRrPpleB:t:i:x:SsYyK:Zz", &l) ;
+ int opt = subgetopt_r(argc, argv, "qQv461c:C:b:G:g:u:UWwDdHhRrPpleB:t:i:x:SsYyK:Zzk:", &l) ;
if (opt == -1) break ;
switch (opt)
{
@@ -131,6 +133,7 @@ int main (int argc, char const *const *argv)
case 'K' : if (!uint0_scan(l.arg, &o.kimeout)) dieusage() ; break ;
case 'Z' : o.flagZ = 1 ; break ;
case 'z' : o.flagZ = 0 ; break ;
+ case 'k' : if (!uint0_scan(l.arg, &o.snilevel)) dieusage() ; break ;
default : dieusage() ;
}
}
@@ -142,7 +145,7 @@ int main (int argc, char const *const *argv)
size_t pos = 0 ;
unsigned int m = 0 ;
char fmt[UINT_FMT * 5 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ;
- char const *newargv[45 + argc] ;
+ char const *newargv[46 + argc] ;
newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ;
if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ;
if (o.flag46) newargv[m++] = o.flag46 == 1 ? "-4" : "-6" ;
@@ -223,6 +226,8 @@ int main (int argc, char const *const *argv)
fmt[pos++] = 0 ;
}
if (o.flagZ) newargv[m++] = "-Z" ;
+ if (o.snilevel >= 2) newargv[m++] = "-k2" ;
+ else if (o.snilevel) newargv[m++] = "-k1" ;
newargv[m++] = "--" ;
if (o.doapply)
{
diff --git a/src/tls/s6-ucspitlsd.c b/src/tls/s6-ucspitlsd.c
index 2ece32f..d24cf99 100644
--- a/src/tls/s6-ucspitlsd.c
+++ b/src/tls/s6-ucspitlsd.c
@@ -13,11 +13,11 @@
#include <s6-networking/config.h>
#include "s6tls-internal.h"
-#define USAGE "s6-ucspitlsd [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
+#define USAGE "s6-ucspitlsd [ -S | -s ] [ -Y | -y ] [ -k snilevel ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
#define dieusage() strerr_dieusage(100, USAGE)
-static inline void child (int [4][2], uint32_t, unsigned int, unsigned int) gccattr_noreturn ;
-static inline void child (int p[4][2], uint32_t options, unsigned int verbosity, unsigned int kimeout)
+static inline void child (int [4][2], uint32_t, unsigned int, unsigned int, unsigned int) gccattr_noreturn ;
+static inline void child (int p[4][2], uint32_t options, unsigned int verbosity, unsigned int kimeout, unsigned int snilevel)
{
int fds[3] = { p[0][0], p[1][1], p[2][1] } ;
ssize_t r ;
@@ -41,13 +41,14 @@ static inline void child (int p[4][2], uint32_t options, unsigned int verbosity,
default :
strerr_dief1x(100, "unrecognized command on control socket") ;
}
- s6tls_exec_tlsdio(fds, options, verbosity, kimeout) ;
+ s6tls_exec_tlsdio(fds, options, verbosity, kimeout, snilevel) ;
}
-int main (int argc, char const *const *argv, char const *const *envp)
+int main (int argc, char const *const *argv)
{
unsigned int verbosity = 1 ;
unsigned int kimeout = 0 ;
+ unsigned int snilevel = 0 ;
int p[4][2] = { [3] = { 0, 1 } } ;
uint32_t coptions = 0 ;
uint32_t poptions = 1 ;
@@ -57,7 +58,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
subgetopt_t l = SUBGETOPT_ZERO ;
for (;;)
{
- int opt = subgetopt_r(argc, argv, "SsYyv:K:Zz", &l) ;
+ int opt = subgetopt_r(argc, argv, "SsYyv:K:Zzk:", &l) ;
if (opt == -1) break ;
switch (opt)
{
@@ -69,6 +70,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
case 'K' : if (!uint0_scan(l.arg, &kimeout)) dieusage() ; break ;
case 'Z' : poptions &= ~1 ; break ;
case 'z' : poptions |= 1 ; break ;
+ case 'k' : if (!uint0_scan(l.arg, &snilevel)) dieusage() ; break ;
default : dieusage() ;
}
}
@@ -82,7 +84,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
switch (fork())
{
case -1 : strerr_diefu1sys(111, "fork") ;
- case 0 : child(p, coptions, verbosity, kimeout) ;
+ case 0 : child(p, coptions, verbosity, kimeout, snilevel) ;
default : break ;
}
s6tls_ucspi_exec_app(argv, p, poptions) ;
diff --git a/src/tls/s6tls-internal.h b/src/tls/s6tls-internal.h
index 09be544..2ef3b81 100644
--- a/src/tls/s6tls-internal.h
+++ b/src/tls/s6tls-internal.h
@@ -11,7 +11,7 @@
#define s6tls_envvars "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID"
extern void s6tls_exec_tlscio (int const *, uint32_t, unsigned int, unsigned int, char const *) gccattr_noreturn ;
-extern void s6tls_exec_tlsdio (int const *, uint32_t, unsigned int, unsigned int) gccattr_noreturn ;
+extern void s6tls_exec_tlsdio (int const *, uint32_t, unsigned int, unsigned int, unsigned int) gccattr_noreturn ;
extern void s6tls_sync_and_exec_app (char const *const *, int const [4][2], pid_t, uint32_t) gccattr_noreturn ;
extern void s6tls_ucspi_exec_app (char const *const *, int const [4][2], uint32_t) gccattr_noreturn ;
diff --git a/src/tls/s6tls_exec_tlsdio.c b/src/tls/s6tls_exec_tlsdio.c
index 3007cf0..f3bc999 100644
--- a/src/tls/s6tls_exec_tlsdio.c
+++ b/src/tls/s6tls_exec_tlsdio.c
@@ -6,15 +6,16 @@
#include <s6-networking/config.h>
#include "s6tls-internal.h"
-void s6tls_exec_tlsdio (int const *fds, uint32_t options, unsigned int verbosity, unsigned int kimeout)
+void s6tls_exec_tlsdio (int const *fds, uint32_t options, unsigned int verbosity, unsigned int kimeout, unsigned int snilevel)
{
- char const *newargv[13] ;
+ char const *newargv[15] ;
unsigned int m = 0 ;
char fmtv[UINT_FMT] ;
char fmtd[UINT_FMT] ;
char fmtk[UINT_FMT] ;
char fmtr[UINT_FMT] ;
char fmtw[UINT_FMT] ;
+ char fmti[UINT_FMT] ;
newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tlsd-io" ;
if (verbosity != 1)
@@ -38,6 +39,12 @@ void s6tls_exec_tlsdio (int const *fds, uint32_t options, unsigned int verbosity
newargv[m++] = fmtk ;
fmtk[uint_fmt(fmtk, kimeout)] = 0 ;
}
+ if (snilevel)
+ {
+ newargv[m++] = "-k" ;
+ newargv[m++] = fmti ;
+ fmti[uint_fmt(fmti, snilevel)] = 0 ;
+ }
newargv[m++] = "--" ;
newargv[m++] = fmtr ;
fmtr[uint_fmt(fmtr, fds[0])] = 0 ;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-10 08:27:58 +0000